The present invention relates primarily to self service terminals (SSTs), such as automatic teller machines (ATMs), and in particular to a system for detecting fraudulent activity in relation to an SST.
SSTs, such as automated teller machines (ATMs), are commonly and increasingly used to carry out many everyday transactions which do not require human supervision. In the case of ATMs, one of the most frequently executed transactions is the withdrawal of cash from bank accounts, although other transactions may involve electronic transfer of funds between accounts, bill payments, or simply obtaining an indication of an account balance or a xe2x80x98mini-statementxe2x80x99 providing details of recent transactions.
Conventional ATMs incorporate one or more customer interfaces via which a customer (i.e. a user) confirms their identity, for example, a card reader slot in the ATM into which the customer inserts a magnetic stripe card, and/or a key pad by means of which a customer confirms their identity by, for example, entering a personal identification number (PIN) associated with the magnetic stripe card, but known only to the user. Self service terminals are capable of being compromised by the addition of xe2x80x98alienxe2x80x99 devices, which are introduced to the customer interface of the terminal. These devices, which are typically used to capture normally secure data such as account details and customer PINs, are usually carefully sculpted onto the surface of the terminal, and may be extremely difficult to detect by the untrained eye. In some instances, the xe2x80x98alienxe2x80x99 device may be introduced into one or more of various customer interface xe2x80x98aperturesxe2x80x99 of the terminal e.g. card reader, depository, or dispenser slots, to physically restrain items of value which are then subsequently recovered by the would-be fraudster who may then use them to conduct fraudulent activity.
It is an object of the present invention to provide a system that reduces the risk of one or more of the aforementioned fraudulent activities occurring.
According to a first aspect of the present invention, there is provided a monitoring system for use with a self-service terminal (SST) having a user interface, the system comprising; image capture means for capturing images of at least part of the user interface; image storage means for storing at least one image captured by the image capture means; image processing means for comparing the at least one stored image with a subsequently captured image of the part of the user interface so as to detect the addition of an alien device to the part of the user interface; and alarm means for generating an alarm signal if the image processing means detects the addition of an alien device.
One advantage of the invention is that changes in the appearance of the fascia of the SST due to the addition of one or more alien devices can be detected using the system. The system can be configured so that any attempt by a fraudster to obscure the image capturing means, in order to prevent an image of the SST from being captured, will be detected by the system.
By using a suitable image capture means the system may be able to monitor the entire user interface. If the entire user interface is monitored, the addition of any alien devices placed either on top of or along side any user interface element (e.g. a key pad, a card entry/exit slot, or such like) can be detected. As well as being capable of detecting alien devices on the surface of the SST the system can also be used to detect unusual patterns of activity associated with the introduction of alien devices to the SST, as will later be described in more detail.
The image capture means may comprise one or more cameras, for example in the form of a solid state imaging device which may be mounted in the SST at a suitable position for capturing an image of one or more parts of the user interface of the SST. Alternatively, or additionally, the image capture means may incorporate optical fibers embedded in the SST.
The image capture means may additionally include further optical elements such as one or more prisms, lenses or the like for capturing an image of the one or more parts of the user interface that is conveyed by the optical fibers to the image processing means and/or the image storage means.
The image storage means preferably stores one or more images captured by the image capture means as digital data files. The image processing means is preferably in the form of a micro-processor that is programmed to subtract a stored image from a subsequently captured image received from the image capture means, and to process the resultant image to detect differences between the stored image and the subsequently captured image due to the addition of one or more alien devices to part of the user interface of the SST.
In the preferred embodiment, a series of xe2x80x98passivexe2x80x99 images of the SST, captured by the image capture means, are stored in the image storage means, each image having been captured during different lighting conditions. The image processing means preferably compares a subsequently captured xe2x80x98livexe2x80x99 image with each of the stored images. The image processing means may be programmed to control activation of the alarm means so that an alarm signal is only generated when the image processing means detects the addition of an alien device with respect to more than a predetermined minimum number of the stored images. This minimizes false alarms due to different lighting conditions in the SST surrounding environment.
It will be appreciated that a captured image to be compared with one or more of the stored images may also be stored, at least temporarily, in the image storage means.
The image processing means may be programmed to perform time averaging of images captured by the image capture means for preventing legitimate use of the SST from triggering an alarm system. For example, the image processing means may be programmed to store a number of images captured by the image capture means over a predetermined period of time, in the image storage means, and to carry out a time averaging process of these stored images prior to subtracting one of the previously stored xe2x80x98passivexe2x80x99 images therefrom.
In a more sophisticated implementation of the invention the image processing means is further configured to analyze xe2x80x98traffic patternsxe2x80x99, at one or more user interface apertures (e.g. a card slot or a bank note dispenser slot) of the SST to determine if unusual activity is occurring, for example a fraudster""s attempts to introduce an alien device in the aperture. The term xe2x80x98traffic patternxe2x80x99 as used herein refers to the areas of the user interface that a user""s hands and arms cover during a typical transaction, and to the time periods that these areas are typically covered for during a transaction. Any traffic pattern that deviates substantially from a typical traffic pattern may be a result of a fraudulent user attempting to locate an alien device on the SST.
The image processing means may be programmed with suitable algorithms for processing images captured by the image capture means over a period of time to determine if such unusual activity is occurring. These algorithms may utilize feedback from the above-described xe2x80x98basicxe2x80x99 implementation of the invention in which one or more stored xe2x80x98passivexe2x80x99 images are subtracted from the subsequently captured image(s), to further refine the detection of alien devices and further reduce the chance of an alarm signal being produced during legitimate use of the SST.
The image capture means may operate in the visible part of the spectrum, but may alternatively or additionally capture images outside the visible spectrum. For example, infra-red or ultra-violet images may be captured and processed for detecting the addition of alien devices.
The alarm signal produced by the alarm means is preferably relayed to an alarm unit for generating an audible alarm and/or a visual alarm remote from the ATM. The alarm unit may be located in a control center that monitors the operation of a one or more ATMs. In some units, the alarm unit may be located within, or local to, the ATM.
According to another aspect of the invention, there is provided a self-service terminal (SST) incorporating a monitoring system as above described.
According to a yet further aspect of the invention, there is provided a method of detecting the addition of an xe2x80x98alienxe2x80x99 device to a self-service terminal (SST), the method comprising the steps of: capturing images of at least part of a user interface of an SST; storing at least one captured image; processing the at least one stored image and a subsequently captured image so as to compare the two images for detecting the addition of an alien device to the at least part of a user interface; and producing an alarm signal when the addition of an alien device is so detected.